AWS Organizations

Features

With Organizations, you can create groups of accounts and then apply policies to those groups.

Organizations provides you a policy framework for multiple AWS accounts. You can apply policies to a group of accounts or all the accounts in your organization.

AWS Organizations enables you to set up a single payment method for all the AWS accounts in your organization through consolidated billing. With consolidated billing, you can see a combined view of charges incurred by all your accounts, as well as take advantage of pricing benefits from aggregated usage, such as volume discounts for EC2 and S3.

AWS Organizations, like many other AWS services, is eventually consistent. It achieves high availability by replicating data across multiple servers in AWS data centers within its region.

Administrative Actions in Organizations

Create an AWS account and add it to your organization, or add an existing AWS account to your organization.

Concepts

An organization is a collection of AWS accounts that you can organize into a hierarchy and manage centrally.

A master account is the AWS account you use to create your organization. You cannot change which account in your organization is the master account.

From the master account, you can create other accounts in your organization, invite and manage invitations for other accounts to join your organization, and remove accounts from your organization.

You can also attach policies to entities such as administrative roots, organizational units (OUs), or accounts within your organization.

The master account has the role of a payer account and is responsible for paying all charges accrued by the accounts in its organization.

A member account is an AWS account, other than the master account, that is part of an organization. A member account can belong to only one organization at a time. The master account has the responsibilities of a payer account and is responsible for paying all charges that are accrued by the member accounts.

An administrative root is the starting point for organizing your AWS accounts. The administrative root is the top-most container in your organization’s hierarchy. Under this root, you can create OUs to logically group your accounts and organize these OUs into a hierarchy that best matches your business needs.

An organizational unit (OU) is a group of AWS accounts within an organization. An OU can also contain other OUs enabling you to create a hierarchy.

A policy is a “document” with one or more statements that define the controls that you want to apply to a group of AWS accounts.

Service control policy (SCP) is a policy that specifies the services and actions that users and roles can use in the accounts that the SCP affects. SCPs are similar to IAM permission policies except that they don’t grant any permissions. Instead, SCPs are filters that allow only the specified services and actions to be used in affected accounts.

AWS Organizations has two available feature sets:

All organizations support consolidated billing, which provides basic management tools that you can use to centrally manage the accounts in your organization.

If you enable all features, you continue to get all the consolidated billing features plus a set of advanced features such as service control policies.

You can remove an AWS account from an organization and make it into a standalone account.

Organization Hierarchy

Including root and AWS accounts created in the lowest OUs, your hierarchy can be five levels deep.

Policies inherited through hierarchical connections in an organization.

Policies can be assigned at different points in the hierarchy.

Pricing

AWS Certified Solutions Architect is consistently among the top paying IT certifications in the world, considering that Amazon Web Services is the leading cloud services platform with almost 50% market share! Earn over $150,000 per year with an AWS certification!

Subscribe to our newsletter for more helpful AWS training notes and blogs like this and answer as many AWS practice exams as you can. 🙂